mirror of
https://github.com/elastic/protections-artifacts
synced 2026-06-08 14:02:19 +00:00
protectionsmachine
90 lines
3.9 KiB
TOML
90 lines
3.9 KiB
TOML
[rule]
|
|
description = """
|
|
Detects suspicious Python shell executions by monitoring the Python parent process and command line arguments. The
|
|
command like arguments contain keywords that are commonly used by attackers to execute malicious code.
|
|
"""
|
|
id = "d9617a18-cf8b-4bae-b335-598ddabc287c"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious Python Shell Execution"
|
|
os_list = ["linux"]
|
|
version = "1.0.13"
|
|
|
|
query = '''
|
|
process where event.type == "start" and event.action == "exec" and process.working_directory != null and
|
|
process.parent.executable like~ ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
|
|
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
|
|
process.parent.command_line like~ (
|
|
"*exec(*", "*eval(*", "*subprocess*", "*marshal*", "*pickle*", "*pty.*", "*binascii*", "*codecs*",
|
|
"*os.system(*", "*os.popen(*", "*pty.spawn(*", "*socket.AF_INET*", "*dup2*", "*fileno()*", "*zlib*",
|
|
"*connect(*", "*bind(*", "*execve(*", "*base64*", "*base32*", "*base16*", "*base85*", "*decode(*"
|
|
) and not (
|
|
process.command_line like~ (
|
|
"sh -c /sbin/ldconfig -p 2>/dev/null", "/bin/sh -c mdatp health --field*", "/bin/sh -c uname -p 2> /dev/null",
|
|
"/bin/sh -c which hipcc | xargs readlink -f", "*pip install*", "/bin/sh -c ip -o link",
|
|
"sh -c -- /bin/su -c echo test", """sh -c -- /bin/su root -c "echo test""""
|
|
) or
|
|
process.parent.executable like~ (
|
|
"/run/containerd/*", "/var/lib/docker/overlay2/*", "/mcp/images/overlay2/*", "/u01/app/oracle.ahf/*", "/opt/SIGOS/generic_decoder/venv/bin/python",
|
|
"/bin/sh -c dmidecode --quiet"
|
|
) or
|
|
process.parent.args like~ (
|
|
"""import zlib,base64; exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTb*""",
|
|
"easybuild.main", "*Thomas Nagy*", "*https://waf.io/book/index.html#_obtaining_the_waf_file*",
|
|
"/usr/lib/portage/python*/pid-ns-init", "/usr/lib/python-exec/python*/emerge", "/usr/bin/py3compile"
|
|
) or
|
|
process.parent.command_line in (
|
|
"/usr/local/bin/python -u -c import sys;exec(eval(sys.stdin.readline()))",
|
|
"/usr/bin/python3 -u -c import sys;exec(eval(sys.stdin.readline()))"
|
|
) or
|
|
process.parent.command_line like (
|
|
"*pip-setuptools-caller*", "*pip-install*",
|
|
"python -c import sys;import base64;sys.stdout.write('@Main\n');exec(base64.b64decode(sys.stdin.readline().rstrip()))#ZeroNetworks"
|
|
) or
|
|
process.args like "sshpass*" or
|
|
process.working_directory like~ (
|
|
"/builds/*", "/var/lib/waagent/*", "/workspaces/*", "/build/*", "/opt/airflow", "/opt/bliu/.tmp/pip-install-*",
|
|
"/tmp/pip-install-*", "/var/tmp/pip-install-*", "/tmp/pip-build*", "/tmp/pip-wheel-*",
|
|
"/usr/local/apps/amd/friday/inl/projects/moose/petsc", "/opt/moose/*", "/tmp/petsc-*/config.setCompilers",
|
|
"/tmp/cmdickens/easybuild/*", "/tmp/thangha/easybuild/*", "/tmp/pip-download*",
|
|
"/opt/prj/connectxx/cmake-build-flexible-forwarder", "/opt/wBuild/docker/overlay2/*", "/opt/zeek",
|
|
"/scratch/*", "/var/tmp/portage/*", "/tmp/baum/easybuild/*"
|
|
) or
|
|
(process.parent.executable == "/opt/oracle.ahf/python/bin/python3.10" and process.command_line like~ "/bin/sh -c command -v *") or
|
|
(
|
|
process.parent.name like "python2*" and (
|
|
process.parent.args like ("feishu.py", "/home/*/lib/python/pyflow/pyflowTaskWrapper.py") or
|
|
process.args like "sudo status*" or
|
|
process.command_line == "sh -c uname -p 2> /dev/null"
|
|
)
|
|
)
|
|
)
|
|
'''
|
|
|
|
min_endpoint_version = "7.15.0"
|
|
optional_actions = []
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.entity_id"
|
|
state = 0
|
|
|
|
[[threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
[[threat.technique.subtechnique]]
|
|
id = "T1059.006"
|
|
name = "Python"
|
|
reference = "https://attack.mitre.org/techniques/T1059/006/"
|
|
|
|
|
|
|
|
[threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[internal]
|
|
min_endpoint_version = "7.15.0"
|